hermes-github-app-plugin 0.1.2__tar.gz → 0.3.0__tar.gz

hermes_github_app_plugin-0.3.0/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/.github/workflows/cd.yaml

@@ -15,8 +15,8 @@ jobs:
     outputs:
       release_tag: ${{ steps.validate.outputs.release_tag }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - name: Validate tag and package version
@@ -47,8 +47,8 @@ jobs:
     if: needs.validate-tag.outputs.release_tag == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
           cache: pip
@@ -59,7 +59,7 @@ jobs:
       - name: Check distribution metadata
         run: python -m twine check dist/*
       - name: Upload distribution artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: python-distribution
           path: dist/*
@@ -75,7 +75,7 @@ jobs:
       id-token: write
     steps:
       - name: Download distribution artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: python-distribution
           path: dist

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/.github/workflows/ci.yaml

@@ -14,8 +14,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: hermes-github-app-plugin
-Version: 0.1.2
+Version: 0.3.0
 Summary: Hermes plugin for per-agent GitHub App identity, gh/git wrappers, and GitHub App-aware tools.
 Author: Hermes GitHub App Plugin Contributors
 License: MIT
@@ -26,7 +26,12 @@ Each Hermes agent runs the same package but is configured with its own GitHub Ap
 ```yaml
 github_app:
   client_id: "Iv1.exampleclientid"
+  # Optional default used when a command cannot infer OWNER/REPO.
   installation_id: "987654"
+  # Optional owner-specific installation IDs for apps installed in multiple orgs.
+  installation_ids:
+    ExampleOrg: "123456"
+    ExampleInfra: "987654"
   private_key_path: "~/.hermes/secrets/agent-github-app.private-key.pem"
   app_slug: "hermes-agent"
 ```
@@ -35,8 +40,10 @@ Environment variables with the same meaning are also supported:
 
 - `GITHUB_APP_CLIENT_ID`
 - `GITHUB_APP_INSTALLATION_ID`
+- `GITHUB_APP_INSTALLATION_IDS` (JSON object or `OWNER=ID,OWNER2=ID2` mapping)
 - `GITHUB_APP_PRIVATE_KEY_PATH`
 - `GITHUB_APP_PRIVATE_KEY` (PEM contents; useful for CI)
+- `GITHUB_APP_TOKEN_BROKER=nono` (no private key in this environment; see [Running inside nono](#running-inside-nono-token-broker-mode))
 
 Repository access is controlled by the GitHub App installation scope in GitHub. If an agent should not access a repository, remove that repository from the GitHub App installation scope.
 
@@ -46,7 +53,7 @@ Repository access is controlled by the GitHub App installation scope in GitHub.
 
 `installation_id` identifies one installation of that app on a specific user or organization account. It is required when exchanging the app JWT for an installation access token via `POST /app/installations/{installation_id}/access_tokens`.
 
-In other words: `client_id` answers "which GitHub App is signing this JWT?" while `installation_id` answers "which installed copy of that app should this token act as?" The same GitHub App can have multiple installation IDs if it is installed on multiple accounts.
+In other words: `client_id` answers "which GitHub App is signing this JWT?" while `installation_id` answers "which installed copy of that app should this token act as?" The same GitHub App can have multiple installation IDs if it is installed on multiple accounts. Configure `installation_ids` when one app is installed in multiple organizations; the plugin chooses an owner-specific ID from `--repo OWNER/REPO` or `/repos/OWNER/REPO` REST paths and falls back to `installation_id` when no repository owner is available.
 
 ## Install
 
@@ -72,6 +79,8 @@ For scripted installs, pass flags and skip the network verification until secret
 hermes-github-app setup --non-interactive --skip-verify \
   --client-id Iv1.exampleclientid \
   --installation-id 987654 \
+  --installation-id-for ExampleOrg=123456 \
+  --installation-id-for ExampleInfra=987654 \
   --private-key-path ~/.hermes/secrets/agent-github-app.private-key.pem \
   --app-slug hermes-agent
 ```
@@ -94,6 +103,35 @@ git-app --repo OWNER/REPO push origin my-branch
 `gh-app` injects an ephemeral installation token as `GH_TOKEN` and `GITHUB_TOKEN` for the child `gh` process.
 `git-app` injects a temporary askpass helper so HTTPS Git operations authenticate as the GitHub App installation token without writing credentials into the remote URL.
 
+## Running inside nono (token broker mode)
+
+[nono](https://nono.sh) can run the agent in a sandbox that never holds the GitHub App private key. Enable broker mode with `GITHUB_APP_TOKEN_BROKER=nono` or `github_app.token_broker: nono`:
+
+```yaml
+github_app:
+  client_id: "Iv1.exampleclientid"
+  installation_ids:
+    ExampleOrg: "123456"
+  token_broker: nono
+```
+
+```bash
+hermes-github-app setup --token-broker nono --client-id Iv1.exampleclientid --installation-id 987654
+```
+
+In broker mode the plugin reads no private key; `private_key_path` and `GITHUB_APP_PRIVATE_KEY*` are ignored. Installation tokens are not minted locally. The plugin sends the placeholder `nono-phantom-github-app` as its token, and nono's supervisor, outside the sandbox, handles the real credentials:
+
+- Its TLS-intercepting proxy replaces the `Authorization` header on requests to `api.github.com`, `uploads.github.com`, and `github.com` with an installation token chosen by owner from the request path. Git HTTPS uses the same token as Basic `x-access-token`.
+- The app JWT is injected for exactly `GET /app`.
+
+What this means for agents:
+
+- `github_app_*` tools, `hermes-github-app api`, `gh-app`, and `git-app` work unchanged; the placeholder flows through.
+- Plain `git push` over HTTPS and plain `gh` also work, because the proxy injects credentials into those requests. Keep remotes HTTPS. SSH remotes use local SSH keys and are not covered.
+- The agent cannot obtain a real token, by design. `hermes-github-app token` prints the placeholder with a note on stderr.
+- `client_id` is still required in broker mode. It is non-secret and is reported in auth metadata.
+- `hermes-github-app doctor` shows a `token broker` check and an `HTTPS_PROXY set` check. If the proxy variable is missing, the agent is not running inside nono and no credentials will be injected.
+
 ## Migrating existing Hermes skills and jobs
 
 To keep agents from falling back to local human credentials, update existing GitHub-related Hermes skills, cron jobs, and subagent prompts with these rules:
@@ -127,8 +165,8 @@ Before the first release, configure PyPI Trusted Publishing for this repository
 Release example:
 
 ```bash
-git tag 0.1.2
-git push origin 0.1.2
+git tag 0.3.0
+git push origin 0.3.0
 ```
 
 Tags like `v0.1.0`, `0.1`, or `0.1.0rc1` will not publish.

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/README.md

@@ -7,7 +7,12 @@ Each Hermes agent runs the same package but is configured with its own GitHub Ap
 ```yaml
 github_app:
   client_id: "Iv1.exampleclientid"
+  # Optional default used when a command cannot infer OWNER/REPO.
   installation_id: "987654"
+  # Optional owner-specific installation IDs for apps installed in multiple orgs.
+  installation_ids:
+    ExampleOrg: "123456"
+    ExampleInfra: "987654"
   private_key_path: "~/.hermes/secrets/agent-github-app.private-key.pem"
   app_slug: "hermes-agent"
 ```
@@ -16,8 +21,10 @@ Environment variables with the same meaning are also supported:
 
 - `GITHUB_APP_CLIENT_ID`
 - `GITHUB_APP_INSTALLATION_ID`
+- `GITHUB_APP_INSTALLATION_IDS` (JSON object or `OWNER=ID,OWNER2=ID2` mapping)
 - `GITHUB_APP_PRIVATE_KEY_PATH`
 - `GITHUB_APP_PRIVATE_KEY` (PEM contents; useful for CI)
+- `GITHUB_APP_TOKEN_BROKER=nono` (no private key in this environment; see [Running inside nono](#running-inside-nono-token-broker-mode))
 
 Repository access is controlled by the GitHub App installation scope in GitHub. If an agent should not access a repository, remove that repository from the GitHub App installation scope.
 
@@ -27,7 +34,7 @@ Repository access is controlled by the GitHub App installation scope in GitHub.
 
 `installation_id` identifies one installation of that app on a specific user or organization account. It is required when exchanging the app JWT for an installation access token via `POST /app/installations/{installation_id}/access_tokens`.
 
-In other words: `client_id` answers "which GitHub App is signing this JWT?" while `installation_id` answers "which installed copy of that app should this token act as?" The same GitHub App can have multiple installation IDs if it is installed on multiple accounts.
+In other words: `client_id` answers "which GitHub App is signing this JWT?" while `installation_id` answers "which installed copy of that app should this token act as?" The same GitHub App can have multiple installation IDs if it is installed on multiple accounts. Configure `installation_ids` when one app is installed in multiple organizations; the plugin chooses an owner-specific ID from `--repo OWNER/REPO` or `/repos/OWNER/REPO` REST paths and falls back to `installation_id` when no repository owner is available.
 
 ## Install
 
@@ -53,6 +60,8 @@ For scripted installs, pass flags and skip the network verification until secret
 hermes-github-app setup --non-interactive --skip-verify \
   --client-id Iv1.exampleclientid \
   --installation-id 987654 \
+  --installation-id-for ExampleOrg=123456 \
+  --installation-id-for ExampleInfra=987654 \
   --private-key-path ~/.hermes/secrets/agent-github-app.private-key.pem \
   --app-slug hermes-agent
 ```
@@ -75,6 +84,35 @@ git-app --repo OWNER/REPO push origin my-branch
 `gh-app` injects an ephemeral installation token as `GH_TOKEN` and `GITHUB_TOKEN` for the child `gh` process.
 `git-app` injects a temporary askpass helper so HTTPS Git operations authenticate as the GitHub App installation token without writing credentials into the remote URL.
 
+## Running inside nono (token broker mode)
+
+[nono](https://nono.sh) can run the agent in a sandbox that never holds the GitHub App private key. Enable broker mode with `GITHUB_APP_TOKEN_BROKER=nono` or `github_app.token_broker: nono`:
+
+```yaml
+github_app:
+  client_id: "Iv1.exampleclientid"
+  installation_ids:
+    ExampleOrg: "123456"
+  token_broker: nono
+```
+
+```bash
+hermes-github-app setup --token-broker nono --client-id Iv1.exampleclientid --installation-id 987654
+```
+
+In broker mode the plugin reads no private key; `private_key_path` and `GITHUB_APP_PRIVATE_KEY*` are ignored. Installation tokens are not minted locally. The plugin sends the placeholder `nono-phantom-github-app` as its token, and nono's supervisor, outside the sandbox, handles the real credentials:
+
+- Its TLS-intercepting proxy replaces the `Authorization` header on requests to `api.github.com`, `uploads.github.com`, and `github.com` with an installation token chosen by owner from the request path. Git HTTPS uses the same token as Basic `x-access-token`.
+- The app JWT is injected for exactly `GET /app`.
+
+What this means for agents:
+
+- `github_app_*` tools, `hermes-github-app api`, `gh-app`, and `git-app` work unchanged; the placeholder flows through.
+- Plain `git push` over HTTPS and plain `gh` also work, because the proxy injects credentials into those requests. Keep remotes HTTPS. SSH remotes use local SSH keys and are not covered.
+- The agent cannot obtain a real token, by design. `hermes-github-app token` prints the placeholder with a note on stderr.
+- `client_id` is still required in broker mode. It is non-secret and is reported in auth metadata.
+- `hermes-github-app doctor` shows a `token broker` check and an `HTTPS_PROXY set` check. If the proxy variable is missing, the agent is not running inside nono and no credentials will be injected.
+
 ## Migrating existing Hermes skills and jobs
 
 To keep agents from falling back to local human credentials, update existing GitHub-related Hermes skills, cron jobs, and subagent prompts with these rules:
@@ -108,8 +146,8 @@ Before the first release, configure PyPI Trusted Publishing for this repository
 Release example:
 
 ```bash
-git tag 0.1.2
-git push origin 0.1.2
+git tag 0.3.0
+git push origin 0.3.0
 ```
 
 Tags like `v0.1.0`, `0.1`, or `0.1.0rc1` will not publish.

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/plugin.yaml

@@ -1,5 +1,5 @@
 name: github-app
-version: 0.1.0
+version: 0.3.0
 description: "GitHub App identity integration for Hermes: per-agent app token minting, GitHub API tools, gh/git wrappers, CLI, and workflow skill."
 author: Hermes GitHub App Plugin Contributors
 provides_tools:
@@ -20,8 +20,14 @@ requires_env:
     description: "GitHub App client ID for this Hermes agent. Can also be set in ~/.hermes/config.yaml under github_app.client_id."
     secret: false
   - name: GITHUB_APP_INSTALLATION_ID
-    description: "GitHub App installation ID for this Hermes agent. Can also be set in ~/.hermes/config.yaml under github_app.installation_id."
+    description: "Default GitHub App installation ID for this Hermes agent. Can also be set in ~/.hermes/config.yaml under github_app.installation_id."
+    secret: false
+  - name: GITHUB_APP_INSTALLATION_IDS
+    description: "Optional owner-to-installation-ID mapping for apps installed in multiple orgs. JSON object or OWNER=ID,OWNER2=ID2. Can also be set under github_app.installation_ids."
     secret: false
   - name: GITHUB_APP_PRIVATE_KEY_PATH
-    description: "Path to the GitHub App private key PEM. Can also be set in ~/.hermes/config.yaml under github_app.private_key_path."
+    description: "Path to the GitHub App private key PEM. Can also be set in ~/.hermes/config.yaml under github_app.private_key_path. Not used when GITHUB_APP_TOKEN_BROKER is set."
     secret: true
+  - name: GITHUB_APP_TOKEN_BROKER
+    description: "Set to nono when the agent runs in the nono sandbox and the token broker injects credentials. No private key is read in this mode. Can also be set in ~/.hermes/config.yaml under github_app.token_broker."
+    secret: false

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hermes-github-app-plugin"
-version = "0.1.2"
+version = "0.3.0"
 description = "Hermes plugin for per-agent GitHub App identity, gh/git wrappers, and GitHub App-aware tools."
 readme = "README.md"
 requires-python = ">=3.10"

{hermes_github_app_plugin-0.1.2/src/hermes_github_app_plugin → hermes_github_app_plugin-0.3.0}/skills/github-app-workflow/SKILL.md

@@ -11,7 +11,17 @@ Use this skill for GitHub operations from Hermes agents that are configured with
 
 ## First-time setup
 
-Run `hermes-github-app setup` to write `github_app` config into `~/.hermes/config.yaml`. The setup walkthrough marks optional values with `(optional)`; the required values are GitHub App client ID, installation ID, and private key path.
+Run `hermes-github-app setup` to write `github_app` config into `~/.hermes/config.yaml`. The setup walkthrough marks optional values with `(optional)`; the required values are GitHub App client ID, a default installation ID or owner-specific `installation_ids`, and private key path. For apps installed in multiple organizations, pass repeated `--installation-id-for OWNER=ID` flags or configure:
+
+```yaml
+github_app:
+  installation_id: "123456"  # default/fallback
+  installation_ids:
+    ExampleOrg: "123456"
+    ExampleInfra: "789012"
+```
+
+The plugin chooses an owner-specific installation ID from `--repo OWNER/REPO` or `/repos/OWNER/REPO` REST API paths and falls back to `installation_id` when no repository owner is available.
 
 After setup, run `hermes-github-app doctor --repo OWNER/REPO` to verify console scripts, config loading, private-key permissions, token minting, and repository access. Use `--skip-network` only for container/image builds where secrets or network access are not available yet.
 
@@ -26,6 +36,14 @@ After setup, run `hermes-github-app doctor --repo OWNER/REPO` to verify console
 7. Expect comments, PRs, and API writes to appear as `<app-slug>[bot]`.
 8. Treat the GitHub App installation scope as the repository access boundary. The plugin does not maintain a separate local repository/owner allowlist.
 
+## Running inside nono (token broker mode)
+
+If `hermes-github-app doctor` reports `token broker: nono`, this agent runs in the nono sandbox. By design it holds no GitHub App private key and cannot obtain a real installation token.
+
+- Do not search for, copy, or request a private key or a real token. `hermes-github-app token` prints a placeholder; nono's proxy outside the sandbox injects the real credentials into GitHub requests.
+- `github_app_*` tools, `gh-app`, and `git-app` work as described above. Plain `gh` and HTTPS `git push` also work because the proxy injects credentials, so keep remotes HTTPS.
+- If `doctor` reports `HTTPS_PROXY set` as failed, the agent is not running inside nono and no credentials will be injected. Stop and report that. Do not fall back to local human credentials or SSH keys.
+
 ## Updating existing Hermes skills
 
 Patch any GitHub-related skill, cron prompt, or subagent instruction that mentions `gh`, `git push`, GitHub SSH remotes, or `@me` assumptions:

{hermes_github_app_plugin-0.1.2 → hermes_github_app_plugin-0.3.0}/src/hermes_github_app_plugin/auth.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import re
 import time
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
@@ -11,9 +12,10 @@ from urllib.parse import urlparse
 import httpx
 import jwt
 
-from .config import GitHubAppConfig
+from .config import NONO_PHANTOM_TOKEN, GitHubAppConfig
 
 _MIN_REDACT_LENGTH = 8
+_BROKERED_TOKEN_LIFETIME = timedelta(hours=1)
 
 
 @dataclass(frozen=True)
@@ -25,6 +27,7 @@ class InstallationToken:
     installation_id: str
     client_id: str
     app_slug: str | None
+    token_broker: str | None = None
 
     @property
     def redacted(self) -> str:
@@ -40,31 +43,60 @@ class GitHubAppAuth:
     def __init__(self, config: GitHubAppConfig, client: httpx.Client | None = None) -> None:
         self._config = config
         self._client = client or httpx.Client(timeout=20)
-        self._cached_token: InstallationToken | None = None
+        self._cached_tokens: dict[str, InstallationToken] = {}
 
     @property
     def config(self) -> GitHubAppConfig:
         return self._config
 
     def create_jwt(self) -> str:
-        """Create a GitHub App JWT for installation-token exchange."""
+        """Create a GitHub App JWT for installation-token exchange.
+
+        In token broker mode there is no key to sign with; the placeholder is sent and the
+        broker replaces it outside the sandbox.
+        """
+        if self._config.token_broker:
+            return NONO_PHANTOM_TOKEN
         now = int(time.time())
         payload = {"iat": now - 60, "exp": now + 9 * 60, "iss": self._config.client_id}
         encoded = jwt.encode(payload, self._config.private_key, algorithm="RS256")
         return str(encoded)
 
-    def get_installation_token(self, *, force_refresh: bool = False) -> InstallationToken:
+    def get_installation_token(
+        self, *, repo: str | None = None, force_refresh: bool = False
+    ) -> InstallationToken:
         """Return a valid installation token, refreshing when near expiry."""
+        installation_id = self._config.installation_id_for_repo(repo)
+        cached_token = self._cached_tokens.get(installation_id)
         if (
             not force_refresh
-            and self._cached_token is not None
-            and self._cached_token.expires_at > datetime.now(timezone.utc) + timedelta(minutes=5)
+            and cached_token is not None
+            and cached_token.expires_at > datetime.now(timezone.utc) + timedelta(minutes=5)
         ):
-            return self._cached_token
+            return cached_token
 
+        if self._config.token_broker:
+            token = self._brokered_token(installation_id)
+        else:
+            token = self._exchange_app_jwt(installation_id)
+        self._cached_tokens[installation_id] = token
+        return token
+
+    def _brokered_token(self, installation_id: str) -> InstallationToken:
+        """Return the placeholder token with no network call; the broker injects the real one."""
+        return InstallationToken(
+            token=NONO_PHANTOM_TOKEN,
+            expires_at=datetime.now(timezone.utc) + _BROKERED_TOKEN_LIFETIME,
+            installation_id=installation_id,
+            client_id=self._config.client_id,
+            app_slug=self._config.app_slug,
+            token_broker=self._config.token_broker,
+        )
+
+    def _exchange_app_jwt(self, installation_id: str) -> InstallationToken:
+        """Exchange the app JWT for an installation access token."""
         response = self._client.post(
-            f"{self._config.github_api_url}/app/installations/"
-            f"{self._config.installation_id}/access_tokens",
+            f"{self._config.github_api_url}/app/installations/{installation_id}/access_tokens",
             headers={
                 "Accept": "application/vnd.github+json",
                 "Authorization": f"Bearer {self.create_jwt()}",
@@ -75,15 +107,13 @@ class GitHubAppAuth:
         data = response.json()
         expires_at_raw = str(data["expires_at"])
         expires_at = datetime.fromisoformat(expires_at_raw.replace("Z", "+00:00"))
-        token = InstallationToken(
+        return InstallationToken(
             token=str(data["token"]),
             expires_at=expires_at,
-            installation_id=self._config.installation_id,
+            installation_id=installation_id,
             client_id=self._config.client_id,
             app_slug=self._config.app_slug,
         )
-        self._cached_token = token
-        return token
 
     def app_request(
         self,
@@ -120,6 +150,8 @@ class GitHubAppAuth:
                 "client_id": self._config.client_id,
                 "app_slug": self._config.app_slug,
                 "installation_id": self._config.installation_id,
+                "installation_ids": dict(self._config.installation_ids),
+                "token_broker": self._config.token_broker,
             },
             "status_code": response.status_code,
             "result": response.json() if response.content else {"ok": True},
@@ -135,7 +167,8 @@ class GitHubAppAuth:
         params: dict[str, Any] | None = None,
     ) -> dict[str, Any]:
         """Call the GitHub REST API using the installation token."""
-        token = self.get_installation_token()
+        repo = repo or repo_from_path(path)
+        token = self.get_installation_token(repo=repo)
         url = (
             path if path.startswith("http") else f"{self._config.github_api_url}/{path.lstrip('/')}"
         )
@@ -158,9 +191,11 @@ class GitHubAppAuth:
             "result": parsed,
         }
 
-    def graphql(self, query: str, variables: dict[str, Any] | None = None) -> dict[str, Any]:
+    def graphql(
+        self, query: str, variables: dict[str, Any] | None = None, *, repo: str | None = None
+    ) -> dict[str, Any]:
         """Call GitHub GraphQL API using the installation token."""
-        token = self.get_installation_token()
+        token = self.get_installation_token(repo=repo)
         response = self._client.post(
             f"{self._config.github_api_url}/graphql",
             headers={
@@ -172,7 +207,7 @@ class GitHubAppAuth:
         )
         response.raise_for_status()
         return {
-            "auth": auth_metadata(token),
+            "auth": auth_metadata(token, repo=repo),
             "status_code": response.status_code,
             "result": response.json(),
         }
@@ -189,6 +224,7 @@ def auth_metadata(token: InstallationToken, *, repo: str | None = None) -> dict[
         "actor_expected": actor,
         "repository": repo,
         "token": token.redacted,
+        "token_broker": token.token_broker,
         "expires_at": token.expires_at.isoformat(),
     }
 
@@ -203,3 +239,17 @@ def requires_app_jwt(path: str) -> bool:
             return False
     normalized = "/" + path_only.lstrip("/")
     return normalized == "/app" or normalized.startswith("/app/")
+
+
+def repo_from_path(path: str) -> str | None:
+    """Infer OWNER/REPO from common REST API repository paths."""
+    path_only = path.split("?", 1)[0]
+    if path_only.startswith("http"):
+        try:
+            path_only = urlparse(path_only).path
+        except ValueError:
+            return None
+    match = re.match(r"^/?repos/([^/]+)/([^/]+)(?:/|$)", path_only)
+    if not match:
+        return None
+    return f"{match.group(1)}/{match.group(2)}"